I-Worm.Langex
Description I-Worm.Langex
Langex is a worm virus spreading via the Internet as an attachment to infected emails. The worm itself is Windows PE EXE file about 3KB in and length written in Assembler.
The worm activates from infected email only in case user clicks on attached file. The worm does not install itself to the system and is not activated anymore (except the cases when user clicks on attached email again).
To spread the worm uses Windows MAPI functions and "answers" to messages from Email box. The worm sends "reply" to each message:
The subject is original message subject with prepended "Re:" text.
The message body begins with the text:
CLIENT NOTICE: the recipient viewed your message and this is the reply message (original version of your message is shown after this text). Due to the differences of text encoding method used by the recipient and the method used on this system, the needed language pack is attached to this message. If the the corrections will be applied, you will be able to read the reply message.
with original message text appended to that, and the attached file name is:
LANG.EXE
The "answerred" message is deleted then by the worm.
The worm also has "copyright" text in its body:
Simple MAPI demonstration : kahuna/TKT'
Check other viruses! Be aware! Use Antiviral Software
Ass.476
Description Ass.476
This is a very dangerous memory resident parasitic virus. It copies itself into Interrupt Vectors Table, hooks INT 21h, and writes itself to the end of COM-files that are executed. On May 31st, the virus corrupts the boot sectors of the floppy disks, and on December 25th, it erases MBR of the hard drive. The virus contains the text string:
Asshole
Assassin.4834
Description Assassin.4834
It is not dangerous not memory resident encrypted parasitic virus. It searches for EXE-files and writes itself at their ends. It displays the message and manifests itself with video effect:
|